Overview

This scenario deploys Site B in-line and the Site A network out-of-path with an available spare router port. It uses Policy-Based Routing (PBR) at the router to redirect traffic destined for the WAN to the Silver Peak appliance.

Network Diagram

Out-of-Path Deployment with Policy-Based Routing (PBR): Router Mode [Spare Router Port Available]

In this example, the Silver Peak appliance optimizes traffic to/from 10.110.33.0/24 and 10.110.11.0/24.

Summary

Appliance Placement	Attached to available router interface: • Appliance wan0 interface connects to available WAN interface. • Do not connect lan0 interface.
Failure Method	Fails-Open: • The appliance behaves as unconnected port in all failure cases (hardware, software, power). • The WAN router sees the link to the appliance go down, Policy-Based Routing fails, unicast routing forwards traffic normally.
IP Addresses	This deployment model requires two IP addresses (on the same or separate subnets): • Silver Peak Appliance data path IP address (to originate and terminate tunnel) • Silver Peak Management IP Address (for appliance configuration and management)   Configure PBR on WAN router • Direct traffic from LAN (subnet/interface) destined for WAN to Silver Peak appliance • Do NOT enable this PBR on the interface to which the Silver Peak appliance connects

Fail-Safe Behavior

Fail-safe behavior should always be tested before production deployment by ensuring that traffic continues to flow in each of the following cases:

1	With the appliance in bypass state

2	With the appliance powered off

3	With the tunnels administratively down.

Summary of Initial Configuration Tasks

The configuration steps are as follows:

	Task	Notes	For detailed instructions, see...
1	Gather all the IP addresses needed for setup	Saves time and avoids mistakes.	“Collecting the Necessary Information”.
2	Install the appliances	Physical appliance: Connect the Site A appliance to the Site A router, and insert the Site B appliance between its WAN edge router and the Ethernet switch. Verify connectivity, connect power, and verify LEDs. Virtual appliance: Configure the hypervisor, with the required interfaces.	Silver Peak Appliance Manager Operator’s Guide Quick Start Guides
3	Configure the appliance	In a browser, access and use the Initial Configuration Wizard to configure each appliance — one in Bridge mode, the other in Router mode. Reboot the appliance after finishing the configuration.	“Using the Initial Config Wizard”.
4	Verify appliance connectivity	Tests data path connectivity. Do NOT proceed until you verify connectivity.	“Verifying Appliance Connectivity”.
5	Enable subnet sharing	This prepares each appliance to share local subnets.	“Enabling Subnet Sharing”.
6	Create a tunnel on each appliance	Specify the local and remote endpoints for the tunnel.	“Creating Tunnels and Updating the Subnet Table”.
7	Configure the router	Access the router’s command line interface, and configure the router for policy-based routing.	“Configuring the Router to Redirect Traffic”.
8	Test the connectivity from both ends	Verify that the tunnel is up and that flows are being optimized.	“Verifying Traffic”.

Collecting the Necessary Information

The example makes the following assumptions:

n	You’re not using DHCP.

n	Speed and duplex for all interfaces are left at the default, auto-negotiation.

n	Although it isn’t a requirement, it’s considered a best practice to use different subnets for mgmt0 and the Appliance data path IP.

Out-of-Path Deployment with Policy-Based Routing (PBR): Router Mode [Spare Router Port Available]

Hostname	A	B
Mode	Out-of-Path (Router)	In-line (Bridge)
Admin Password: Old	admin	admin
Admin Password: New / Confirm
Time Zone
NTP Server IP Address
License (for virtual appliance only)
mgmt0 IP Address / Mask1	192.168.1.7/24	192.168.1.9/24
mgmt0 Next-hop IP Address	192.168.1.1	192.168.1.1
Appliance data path IP Address / Mask	10.110.31.100/24	10.110.11.100/24
Appliance data path Next-hop IP	10.110.31.1/24	10.110.11.1/24
LAN Next-hop IP Address (optional) 2	not applicable	---

---

1

In this example, all mgmt0 IP addresses are in the same subnet. In your actual network, it’s likely that mgmt0 IP addresses are in different subnets.

2

LAN next-hop IP is only required when there are subnets for which the Silver Peak appliance does not have a configured IP address.

Please send comments or suggestions regarding user documentation to techpubs@silver-peak.com.